Snort Alert max_queue_events Parameter

İzzettin Erdem via Snort-devel <[email protected]> Wed, 13 Jun 2018 08:18:13 +0300

Newsgroups	gmane.comp.security.ids.snort.devel
Message-ID	<CAN_SLJWUBuJY7UwB5-4in7kGBs6rRRQJY7DGv07w2Zcu_mkdRw@mail.gmail.com>

Hello,

I changed max_queue_events and log parameter in snort.conf and I expected
all the alerts appear but just 100 alerts appear. I have 1000 rules and all
rules are the same. So if one packet consist one of this rules Snort must
alerts 1000 times. How can I solve this problem ?

Snort.conf

config event_queue: max_queue 1000 log 1000 order_events content_length
config detection: max_queue_events 1000

Thanks

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!